Lucene search

MitreCVE-2014-4908

HistoryJul 11, 2014 - 11:08 a.m.

CVE-2014-4908

2014-07-1111:08:22

CWE-79

mitre

web.nvd.nist.gov

cve-2014-4908

pnp4nagios

xss

remote attackers

web script

html

http-equiv="refresh"

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

5.7

Confidence

High

EPSS

0.003

Percentile

69.4%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in PNP4Nagios through 0.6.22 allow remote attackers to inject arbitrary web script or HTML via the URI used for reaching (1) share/pnp/application/views/kohana_error_page.php or (2) share/pnp/application/views/template.php, leading to improper handling within an http-equiv=“refresh” META element.

Affected configurations

Nvd

Node

pnp4nagiospnp4nagiosRange≤0.6.21

pnp4nagiospnp4nagiosMatch0.6.0

pnp4nagiospnp4nagiosMatch0.6.1

pnp4nagiospnp4nagiosMatch0.6.2

pnp4nagiospnp4nagiosMatch0.6.3

pnp4nagiospnp4nagiosMatch0.6.4

pnp4nagiospnp4nagiosMatch0.6.5

pnp4nagiospnp4nagiosMatch0.6.6

pnp4nagiospnp4nagiosMatch0.6.7

pnp4nagiospnp4nagiosMatch0.6.10

pnp4nagiospnp4nagiosMatch0.6.11

pnp4nagiospnp4nagiosMatch0.6.12

pnp4nagiospnp4nagiosMatch0.6.13

pnp4nagiospnp4nagiosMatch0.6.14

pnp4nagiospnp4nagiosMatch0.6.15

pnp4nagiospnp4nagiosMatch0.6.16

pnp4nagiospnp4nagiosMatch0.6.17

pnp4nagiospnp4nagiosMatch0.6.18

pnp4nagiospnp4nagiosMatch0.6.19

pnp4nagiospnp4nagiosMatch0.6.20

VendorProductVersionCPE
pnp4nagiospnp4nagios*cpe:2.3:a:pnp4nagios:pnp4nagios:*:*:*:*:*:*:*:*
pnp4nagiospnp4nagios0.6.0cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.0:*:*:*:*:*:*:*
pnp4nagiospnp4nagios0.6.1cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.1:*:*:*:*:*:*:*
pnp4nagiospnp4nagios0.6.2cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.2:*:*:*:*:*:*:*
pnp4nagiospnp4nagios0.6.3cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.3:*:*:*:*:*:*:*
pnp4nagiospnp4nagios0.6.4cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.4:*:*:*:*:*:*:*
pnp4nagiospnp4nagios0.6.5cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.5:*:*:*:*:*:*:*
pnp4nagiospnp4nagios0.6.6cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.6:*:*:*:*:*:*:*
pnp4nagiospnp4nagios0.6.7cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.7:*:*:*:*:*:*:*
pnp4nagiospnp4nagios0.6.10cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.10:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
pnp4nagios	pnp4nagios	*	cpe:2.3:a:pnp4nagios:pnp4nagios::::::::
pnp4nagios	pnp4nagios	0.6.0	cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.0:::::::*
pnp4nagios	pnp4nagios	0.6.1	cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.1:::::::*
pnp4nagios	pnp4nagios	0.6.2	cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.2:::::::*
pnp4nagios	pnp4nagios	0.6.3	cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.3:::::::*
pnp4nagios	pnp4nagios	0.6.4	cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.4:::::::*
pnp4nagios	pnp4nagios	0.6.5	cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.5:::::::*
pnp4nagios	pnp4nagios	0.6.6	cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.6:::::::*
pnp4nagios	pnp4nagios	0.6.7	cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.7:::::::*
pnp4nagios	pnp4nagios	0.6.10	cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.10:::::::*